Okta wants every AI agent to carry an ID, with Australia's Medicare breach as the argument

Okta, the identity and access management vendor, is pushing an argument reported by iTWire: every AI agent should carry an identity of its own. The report leans on Australia's Medicare data breach to make the case, presenting it as evidence of what goes wrong when identity boundaries are weak.

The reasoning is straightforward. Enterprises used to ask one question of a request: does it come from an authorized user? Once work is handed to software agents, that becomes a cluster of questions — which agent is this, whose authority does it act under, what data can it reach, and what did it actually do?

Giving agents an ID usually means three things: a unique identifier tied to an accountable owner, a definable scope of permissions, and a traceable record of calls. Remove any one of those and automation turns into an audit blind spot. When automated agents enter enterprise systems at scale, identity governance stops being a back-office compliance topic and becomes an architecture problem.

The Medicare breach is cited as a real-world counterpart, a reminder of what is at stake when identity and access boundaries fail. As the acting party shifts from people to software agents, those boundaries become harder to follow by hand and harder to reconstruct after the fact.

At the industry level, non-human identities are multiplying faster than employee accounts, which makes agent identity the next contested layer of enterprise security. Okta's position is therefore not only product messaging; it is a bid to define how the agent layer is governed inside corporate architecture.

The boundaries of the report matter. What iTWire describes is Okta's position and its argument, not a finished product launch. The report does not say what form the capability will take, when a standard might arrive, or which enterprises would adopt it first.

Three things to watch: whether cross-vendor standards for agent identity emerge, whether cloud platforms and model providers plug into them, and whether regulators start writing non-human identities into formal compliance requirements.